Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (athena.apache.org: domain of trawick@gmail.com designates
 209.85.215.53 as permitted sender)
MIME-Version: 1.0
Date: Fri, 11 Apr 2014 08:38:43 -0400
Message-ID: 
 <CAKUrXK6RkcqKP3=Qz3P_e0Ma+Nt807hAcV+NihBz-WBXgf5Gxg@mail.gmail.com>
Subject: Mini-advisory on heartbeat bug on http://httpd.apache.org/ ?
From: Jeff Trawick <trawick@gmail.com>
To: Apache HTTP Server Development List <dev@httpd.apache.org>
Content-Type: multipart/alternative; boundary=001a1135f56e376bdd04f6c39d19

--001a1135f56e376bdd04f6c39d19
Content-Type: text/plain; charset=ISO-8859-1

SSL/TLS-enabled configurations of Apache HTTP Server with OpenSSL 1.0.1a-f
are vulnerable to CVE-2014-0160, the so called "Heartbleed Bug."

No Apache HTTP Server fix is needed to resolve this; no Apache HTTP Server
configuration change besides disabling SSL/TLS completely can resolve this.
Instead, a patch to OpenSSL, a rebuild of OpenSSL with the TLS Heartbeat
extension disabled, or an upgrade of OpenSSL to 1.0.1g or later is required.

If you obtain OpenSSL in binary form with or without Apache HTTP Server,
contact the supplier of the binary for resolution. If you build OpenSSL
yourself, refer to the OpenSSL project for further information, including
the advisory at http://www.openssl.org/news/secadv_20140407.txt .


XXXX

Have binaries which included an affected level of OpenSSL ever been
distributed from our site?

I don't see anything from the release/httpd/binaries/win32 directory in the
output of svn log -v | grep openssl . (Is that the right check?)

-- 
Born in Roswell... married an alien...
http://emptyhammock.com/
http://edjective.org/

--001a1135f56e376bdd04f6c39d19
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">SSL/TLS-enabled configurations of Apache HTTP Server with =
OpenSSL 1.0.1a-f are vulnerable to=A0<span style=3D"color:rgb(0,0,0);white-=
space:pre-wrap">CVE-2014-0160, the so called &quot;Heartbleed Bug.&quot;</s=
pan><div>
<font color=3D"#000000"><span style=3D"white-space:pre-wrap"><br></span></f=
ont></div><div><font color=3D"#000000"><span style=3D"white-space:pre-wrap"=
>No Apache HTTP Server fix is needed to resolve this; no Apache HTTP Server=
 configuration change besides disabling SSL/TLS completely can resolve this=
.  Instead, a patch to OpenSSL, a rebuild of OpenSSL with the TLS Heartbeat=
 extension disabled, or an upgrade of OpenSSL to 1.0.1g or later is require=
d.</span></font></div>
<div><font color=3D"#000000"><span style=3D"white-space:pre-wrap"><br></spa=
n></font></div><div><font color=3D"#000000"><span style=3D"white-space:pre-=
wrap">If you obtain OpenSSL in binary form</span></font><span style=3D"colo=
r:rgb(0,0,0);white-space:pre-wrap"> with or without Apache HTTP Server</spa=
n><span style=3D"white-space:pre-wrap;color:rgb(0,0,0)">, contact the suppl=
ier of the binary for resolution.  If you build OpenSSL yourself, refer to =
the OpenSSL project for further information, including the advisory at <a h=
ref=3D"http://www.openssl.org/news/secadv_20140407.txt">http://www.openssl.=
org/news/secadv_20140407.txt</a> .</span></div>
<div><font color=3D"#000000"><span style=3D"white-space:pre-wrap"><br></spa=
n></font></div><div><font color=3D"#000000"><span style=3D"white-space:pre-=
wrap"><br></span></font></div><div><font color=3D"#000000"><span style=3D"w=
hite-space:pre-wrap">XXXX</span></font></div>
<div><font color=3D"#000000"><span style=3D"white-space:pre-wrap"><br></spa=
n></font></div><div><font color=3D"#000000"><span style=3D"white-space:pre-=
wrap">Have binaries which included an affected level of OpenSSL ever been d=
istributed from our site?</span></font></div>
<div><font color=3D"#000000"><span style=3D"white-space:pre-wrap"><br></spa=
n></font></div><div><font color=3D"#000000"><span style=3D"white-space:pre-=
wrap">I don&#39;t see anything from the release/httpd/binaries/win32 direct=
ory in the output of svn log -v | grep openssl .  (Is that the right check?=
)<br>
</span></font><div><div><br></div>-- <br><div dir=3D"ltr">Born in Roswell..=
. married an alien...<br><a href=3D"http://emptyhammock.com/" target=3D"_bl=
ank">http://emptyhammock.com/</a><br><div><a href=3D"http://edjective.org/"=
 target=3D"_blank">http://edjective.org/</a></div>
<div><br></div></div>
</div></div></div>

--001a1135f56e376bdd04f6c39d19--